Check Point Quantum Smart-1

Cisco API Console

Cisco Meraki: Systems Manager

Cisco Secure Cloud Analytics

Cisco Secure Firewall

Cisco Umbrella

Cisco XDR: Respond

Microsoft Graph

OCSF v.1.4

Palo Alto Panorama

Slack

Splunk Cloud

This workflow appears in the pivot menu and allows you to add an observable to a threat intelligence feed in Cisco XDR. These feeds can be used by other products to get lists of observables from Cisco XDR. For example, a feed of domains could be used by a firewall to block matching traffic. Supported observables: domain, ip, sha256

Target: Private Intelligence API

Steps:
* Convert the observable type to uppercase
* Search for the indicator the workflow needs
* Check if the indicator was found:
    * If it was, extract its ID and set the local ID variable
    * If it wasn't, attempt to create it and set the local ID variable
* Search for the feed for this observable type
* Check if the feed was found:
    * If it was, extract its ID and set the local ID variable
    * If it wasn't, attempt to create it and set the local ID variable
* Create a malicious judgement for the observable (end the workflow if this fails)
* Relate the judgement to the indicator (end the workflow if this fails)

Cisco XDR - Add Observable to Intelligence Feed

The prefix to use for feed and indicator names. This prefix will be added to the name of the objects created by this workflow. For example, for a prefix of "XDR Automation", the following objects would be created:
- XDR Automation Feed (IP)
- XDR Automation Feed (DOMAIN)
- XDR Automation Feed (SHA256)
- XDR Automation Indicator (IP)
- XDR Automation Indicator (DOMAIN)
- XDR Automation Indicator (SHA256)

Object Name Prefix

How long observables added to the feed should remain there. After this number of days, the observable will be dropped from the feed

Time on Feed (Days)

This workflow appears in the pivot menu and allows a user to unblock an indicator of compromise (IOC) in Microsoft Defender for Endpoint. Supported observables include: domain, IP address, MD5, SHA-1, SHA-256, URL

Target: Microsoft Defender for Endpoint

Steps:
* Check which observable type was provided:
	* If the observable type is supported, set the matching local variable
	* If not supported, return an error
* Loop while there are IOCs to process
	* Get this page of IOCs
	* Convert the list of IOCs to a table
	* For each IOC:
		* Check if this is the IOC we want to unblock:
			* If it is, set the local indicator ID and end the loop
	* Check if there is another page of results (if not, end the loop)
* Check if an indicator ID was found:
	* If it was, unblock it

Microsoft Defender for Endpoint - Unblock IOC

This workflow appears in the pivot menu and allows a user to unisolate an endpoint in Palo Alto Networks Cortex XDR. Supported observables: hostname, IP address, PAN Cortex XDR agent ID

Target: Palo Alto Networks Cortex XDR - v1

Steps:
* Determine which observable type was provided:
	* If a Cortex Agent ID, set the local ID variable
	* If a hostname or IP address, search for the endpoint and set the local ID variable (if an endpoint isn't found, end the workflow)
* Request the endpoint be unisolated

Palo Alto Networks Cortex XDR - Unisolate Endpoint

Instructions:

1. Ensure the remote automation server is set up and configured to establish a connection between the Cisco XDR and the On-Premises Pure Storage Flash Array.

2. Configure the HTTP target for the On-Premises Pure Storage Flash Array within the Cisco XDR.

3. Log in to the On-Premises Pure Storage Flash Array to fetch the API token. Add this token as a static variable in the   workflow to establish the successful API call between the Cisco XDR and the Flash Array.
  reference link -  https://support.purestorage.com/bundle/m_purityfa_rest_api/page/FlashArray/PurityFA/Purity_FA_REST_API/topics/task/t_client_configuration.html

4. Update the input variable to the XDR workflow with the volume names for which snapshots are to be taken 
    "Enter multiple source names in comma-separated format. For example, name01, name02."

5. Optionally, configure an automation rule to run this workflow whenever an incident is triggered by any alerts or logs.
Ensure the workflow is validated (this should occur automatically during installation); otherwise, it will not run.

Pure-Storage-Volume-Snapshot

Pure Storage Flash Array

auth-token

#### Installation and Configuration Instructions

1. **Install the Workflow**
    - Ensure you have the Splunk Cloud integration enabled in XDR.
    - Install the workflow from XDR automate Exchange.
    - Set the Input variables

2. **Automate the Workflow** 
    - When prompted to "Automate it," add a scheduled automation rule or add it later.
    - The interval has to match the one configured in the input variable "Workflow Run Interval"

 3. **Expected behavior**
    - Workflow transforms each collected logs into a Custom Security Event
    - Events are stored as Detection Findings
    - Findings automatically participate in:
      - Correlation
      - Incident generation

4. **Verification**
    - Navigate to Detection Findings Viewer in Cisco XDR
    - Confirm that:
      - Events are being ingested as Detection Findings
      - Detection Findings may be correlated into Incidents

Splunk Cloud Risk Events (ip_address) - Custom Event Ingestion

Name of the Custom Event Module. (default : Splunk Risk Events
It will be the name use as source of detections findings.
If the module doesn't exist, it will be created by the workflow.

Input - Module Instance Name

Set this value to reflect the schedule interval (in minutes)
Ex : if you schedule the workglow to run every 5 minutes, set this value to 5, if you schedule the workglow to run every 1 hour , set this value to 60

This settings is also used to calculate the query earliest time and max number of results

Input - Workflow Run Interval

Set the default mitre tactic ID to use if not found in log and unable to deduce from indicator (ex : TA0040)

Input - XDR - Default Mitre Tactic

Enter the Splunk index for the collected log (most of the  splunk instance denies the use of "*")

Input - Splunk - Index

If you collect cisco XDR incident in splunk, enter their source name in Splunk - It will be use as a filter in the splunk query (example : cisco_xdr)

Input - Cisco XDR Incident Source Name in Splunk

Convert Timestamp to Human Readable Date

XDR Custom Event ingestion - Identify Direction

Splunk - Get Search Results - Custom - With Retry

Bootstrap Custom Security Event Module

Splunk Cloud Risk Events (Network) - Custom Event Ingestion

This workflow consumes one or more domains and attempts to block them in all supported products. Currently supported products include: Cisco Secure Access, Cisco Umbrella, Cisco XDR (intelligence feeds).

Cisco XDR intelligence feeds can be used by other products, such as firewalls, to fetch lists of observables from XDR for use in policies.

Targets: Automation APIs, Platform APIs, Private Intelligence API, Cisco Secure Access, Umbrella

Steps:
- Check how the workflow was started (if not a playbook task, end the workflow)
- Get a list of targets and extract the supported integrations
- Check if there are supported integrations (if not, end the workflow)
- For each integration:
  - Complete setup as needed depending on the integration
- For each domain:
  - For each integration:
    - Attempt to block the domain in the given integration
    - If the new Cisco Umbrella module is not available, try the legacy one
  - Check if the domain was blocked in at least one product (if not, update the workflow results)

XDR - Contain Incident: Domains

prod-nam

prod-eu

prod-apjc

This workflow consumes one or more SHA-256 file hashes and attempts to block them in all supported products. Currently supported products include: Cisco Secure Endpoint, CrowdStrike, Microsoft Defender for Endpoint (Commercial or GCC), Trend Vision One, and Palo Alto Cortex.

Targets: Automation APIs, Cisco Secure Endpoint, CrowdStrike, Microsoft Defender for Endpoint (Commercial or GCC), Trend Vision One, Palo Alto Cortex

Steps:
- Check how the workflow was started (if not a playbook task, end the workflow)
- Get a list of XDR automation targets and extract the supported integrations
- Check if there are supported integrations available (if not, end the workflow)
- For each file hash:
  - For each integration:
    - Attempt to block the hash in the given integration
  - Check if the hash was blocked in at least one product (if not, update the workflow results)

XDR - Contain Incident: File Hashes

This workflow consumes one or more hostnames and attempts to fetch vulnerability information from all supported products. Currently supported products include: Cisco Secure Endpoint, CrowdStrike, SentinelOne, and Microsoft Defender for Endpoint (Commercial or GCC).

Targets: Automation APIs, Cisco Secure Endpoint, CrowdStrike, SentinelOne, Microsoft Defender for Endpoint (Commercial or GCC)

Steps:
- Check how the workflow was started (if not a playbook task, end the workflow)
- Get a list of XDR automation targets and extract the supported integrations
- Check if there are supported integrations available (if not, end the workflow)
- For each hostname:
  - For each integration:
    - Attempt to find the machine and fetch vulnerability information from the given integration
  - Check if the information was obtained from at least one product (if not, update the workflow results)

XDR - Identify Vulnerabilities

This workflow consumes one or more domains and attempts to restore them. Domains can only be restored using this workflow if they were contained using the corresponding containment playbook. Currently supported products include: Cisco Secure Access, Cisco Umbrella, Cisco XDR (intelligence feeds).

Targets: Automation APIs, Private Intelligence API, Cisco Secure Access, Umbrella

Steps:
- Check how the workflow was started (if not a playbook task, end the workflow)
- Get a list of targets and extract the supported integrations
- Check if there are supported integrations (if not, end the workflow)
- For each integration:
  - Complete setup as needed depending on the integration
- For each domain:
  - For each integration:
    - Attempt to unblock the domain in the given integration
      Note: This will reverse all prior blocks, made outside the context of the response to this incident also
  - Check if the domain was unblocked in at least one product (if not, update the workflow results)

XDR - Restore Domains

This workflow consumes one or more IP addresses and attempts to restore them. IP addresses can only be restored using this workflow if they were contained using the corresponding containment playbook. Currently supported products include: Cisco Secure Access, Cisco Umbrella, Cisco XDR (intelligence feeds).

Targets: Automation APIs, Private Intelligence API, Cisco Secure Access, Umbrella

Steps:
- Check how the workflow was started (if not a playbook task, end the workflow)
- Get a list of targets and extract the supported integrations
- Check if there are supported integrations (if not, end the workflow)
- For each integration:
  - Complete setup as needed depending on the integration
- For each IP address:
  - For each integration:
    - Attempt to unblock the IP address in the given integration
      Note: This will reverse all prior blocks, made outside the context of the response to this incident also
  - Check if the IP address was unblocked in at least one product (if not, update the workflow results)

Automation

A powerful low-to-no-code approach that allows your SOC to start automating complex tasks on day one.

Installable workflows

Built-in workflows

Built-in actions